Attentra is real-time, read-only, Solana-native monitoring for DeFi protocols. Every admin action on your program is watched — durable nonces, authority changes, oracle swaps, parameter mutations — and your team is alerted the moment something drifts. Your security posture is continuously published on-chain as a tamper-evident attestation anyone can verify without trusting our dashboard. Zero keys. Zero custody. Zero sleep lost.
The attackers didn't exploit Drift's code. They exploited its signing pipeline. Over months they built relationships with the Drift Security Council, learned its routines, and used Solana's durable-nonce primitive to get legitimate admins to pre-sign transactions that would execute weeks later.
When those dormant signatures were finally triggered, they handed attackers admin control. Within minutes a fake token was whitelisted as collateral, an oracle the attackers controlled priced it at $1, and 500M of it was borrowed against to drain $285 million in real assets.
Nothing about this attack required a zero-day. Every stage was public on-chain activity. Every stage looked suspicious in isolation and damning in sequence. What was missing was the layer watching for it.
Not smart-contract audits — monitoring. We watch the seven dimensions of admin-surface activity where real attacks originate on Solana.
Pre-signed transactions that can execute weeks after signing — the Drift vector. Every nonce creation and consumption on admin-adjacent accounts is flagged.
Critical signalProgram upgrades, authority transfers, and freeze events on every program you deploy or depend on. Any change to who can deploy code is flagged within seconds.
Critical signalFee changes, collateral whitelists, borrow caps, oracle account swaps. The actual substance of what your protocol does, monitored for every mutation.
High signalNew multisig members, lowered thresholds, removed signers. The same playbook attackers used against Drift, detected the moment it executes.
Critical signalNew price feeds, feed authority changes, stale feeds, price deviations outside tolerance. The fake-CVT-at-$1 pattern, caught before anything borrows against it.
Critical signalNew counterparties, unusual staking activity, cross-chain movement, any interaction with known drainer or phishing wallet graphs.
High signalThe sleeping half of the Drift attack — signed transactions that haven't executed yet. We find them before the trigger pulls.
Critical signalEvery integration starts with a surface review — we map your protocol's specific admin topology and add bespoke rules.
Patterns that span multiple protocols or wallets. If an attacker grooms one Solana protocol, every other Attentra customer benefits from the signal.
Network effectEvery alert includes the raw transaction, a plain-English simulation of what changes, severity reasoning, and a runbook. No ops team has to translate crypto into English.
update_asset_config transaction. Admin action on collateral parameters — highest severity class. Simulation below.
Monitoring tells your team something went wrong. Attestation tells everyone else how you're doing — and does it without asking anyone to trust our dashboard.
Every Attentra customer gets an on-chain attestation account. Every 60 seconds, our engine evaluates your declared security invariants — upgrade authority, admin signer set, timelock duration, oracle feeds, bytecode hash, governance config — and writes the current state to your attestation PDA.
The PDA is a normal Solana account. Your investors, your insurers, your users, your auditors, your aggregator of choice can query it from any RPC endpoint in two seconds. No API key. No Attentra dashboard login. No trust in us beyond the checks themselves, which are open-source and independently reproducible.
A Solana security product that isn't on Solana is just another dashboard. We're on-chain, by construction.
AttrentraAttstn...11111
github.com/attentra-labs/attestation
On-chain attestations are powerful — and dangerous if misused. A false positive published to chain could trigger a panic sell-off in seconds. We designed against that from day one, in four layers.
Attentra runs alongside your existing audits and monitoring — not instead of them. Five stages, zero code changes to your protocol, no private keys shared.
Dedicated Solana validator + Yellowstone gRPC. Every slot, every transaction touching your admin surface, within 400ms of finality.
Seven detection dimensions, ensemble heuristics, protocol-specific rules. Every action tagged with severity and evidence.
Pending and dormant transactions simulated against current state. Output is plain-English: "this enables X to borrow Y against Z."
Your security posture is published to an on-chain attestation account every ~60 seconds. Tamper-evident, independently verifiable, queryable by anyone with an RPC.
Slack, Discord, PagerDuty, SMS, webhooks. Every alert includes evidence, simulation, and a runbook. Your team gets what they need to act — not a riddle to decode.
Every protocol with multisigs, upgrade authorities, or governance parameters has Drift's exposure surface. Attentra is priced so small protocols can afford it and large ones can't afford not to.
Three steps on the same ladder. Start where you can. Upgrade as you earn the right to attest more. Every tier publishes an on-chain score that anyone can read and re-verify with our open-source CLI — the only thing that changes between tiers is how much of your protocol's reality the score is allowed to reflect.
Most security tools price by feature gating. We don't — every tier runs the full detection engine. The tiers represent how much of your protocol's reality the attestation is allowed to reflect. Starter speaks only about your public surfaces. Standard speaks about your declared private commitments. Premium speaks about your private internal configuration under ZK proof. The score on chain becomes a richer, more credible signal as you climb — which is what insurance underwriters and capital allocators reward.
Modern DeFi insurance underwriters need continuous, verifiable evidence that the protocols they cover are operating within their declared parameters. Manual diligence does not scale to the rate at which DeFi protocols ship changes.
Attentra is the on-chain artifact that satisfies this requirement. A live, tamper-evident, third-party-verifiable record of protocol security state — updated every minute, queryable from any RPC, re-verifiable in 30 seconds with our open-source CLI.
STRIDE established the periodic credential layer for Solana DeFi security in April 2026. Attentra is the continuous attestation layer that operates between STRIDE evaluations — minute-by-minute, machine-readable, and embeddable in other protocols' code. Two layers of the same stack. Not competitive — complementary.
We are actively designing the integration surface for DeFi insurance protocols and traditional insurers exploring continuous-attestation underwriting. The attestation schema is open; the CLI verifier is open source; the math is deterministic. If you would like to evaluate Attentra as your underwriting substrate, reach out.
A 20-minute call. We'll show you what Attentra found on your protocol in the last 90 days using only public data. If the number matters, we'll onboard you next week.